IBM Rewriting HTTP (port 80) requests to HTTPS (port 443) - United States rewrite; ssl; plugin; dynamic; static; rules; IHS; WAS TECHNOTE (TROUBLESHOOTING)

PROBLEM(ABSTRACT)
 The rewrite module (mod_rewrite.c) provided with the IBM® HTTP Server can be used as an effective way to automatically rewrite all HTTP requests to HTTPS.

RESOLVING THE PROBLEM
The rewrite module (mod_rewrite.c) can be used to automatically rewrite all HTTP (port 80) requests to HTTPS (port 443). This provides an effective way to ensure that all traffic to and from the IBM HTTP Server is encrypted over the Secure Sockets Layer (SSL) without having to use individual redirects or hard-coded HTTPS links.
Note: The web server should already be configured to handle HTTPS requests successfully
before attempting to implement the following suggestions. For assistance with setting up SSL in the IBM HTTP Server, visit SSL guide [http://www-01.ibm.com/support/docview.wss?uid=swg21179559]

First, make sure the LoadModule line for mod_rewrite is uncommented in the httpd.conf

LoadModule rewrite_module modules/mod_rewrite.so

Next, add the following to the global scope or any port 80 VirtualHost stanzas defined within the httpd.conf configuration file.

RewriteEngine on
RewriteCond %{SERVER_PORT} =80
RewriteRule ^(.*) https://%{SERVER_NAME}%{REQUEST_URI} [R,L]

Finally, restart the IBM HTTP Server after making the preceding changes

Important: If using HTTP authentication, make sure it is only configured for your SSL virtual host. If it also applies to your port 80 requests, the authentication challenge can pre-empt the rewrite, resulting in user IDs and passwords being sent over an unencrypted session.

It is also recommended that you configure your port 80 virtual host with a different document root and so on, from your SSL virtual host. This is to be sure that even if your rewrite fails, sensitive information cannot be served from that virtual host over unencrypted sessions.

RELATED INFORMATION
 Module mod_rewrite..URL Rewriting Engine [http://httpd.apache.org/docs/mod/mod_rewrite.html]

Question: How to have IBM HTTP Server re-direct an application URL from HTTPS to HTTP? We have an application which uses SSL, but we need to make this http only. We disabled all the SSL, but many clients URLs are still pointing to https. So we need a HTTP Server redirect to change these URLs from https to http. Is this possible?

Answer:
First, make sure the LoadModule line for mod_rewrite is uncommented in the httpd.conf

LoadModule rewrite_module modules/mod_rewrite.so

Next, add the following to the global scope or any port 80 VirtualHost stanzas defined within the httpd.conf configuration file.

RewriteEngine on
RewriteCond %{SERVER_PORT} =80
RewriteRule ^(.*) https://%{SERVER_NAME}%{REQUEST_URI} [R,L]

Finally, restart the IBM HTTP Server after making the preceding changes


IBM Does the RRT agent support TLS 1.1/1.2 and 256-bit ciphers? - United States 256-bit ciphers; Strong Encryption; TLS 1.1; TLS 1.2; SSL; Generic Failure; Cannot support; RPT; RRT; T6; 71RRT-RPTPLAN; 71RRT-RPTINS; 71RRT-RPTCONF; 71RRT-RPTPLAY; 71RRT-RPTWV; 71RRT-RPTTS TECHNOTE (FAQ)

QUESTION
 What do you need to do to configure the Robotic Response Time (RRT) agent to support TLS 1.1/1.2 and 256-bit ciphers?

CAUSE
Support for TLS 1.1/1.2 and 256-bit ciphers is determined by the underlying JRE (Java Runtime Environment). Consequently, in order to support TLS 1.1/1.2 and 256-bit ciphers, patch the RPT workbench JRE, and patch the RRT agent JRE. Both JREs must support the same level of TLS.

ANSWER

SSL (Secure Sockets Layer) and TLS (Transport Layer Security) are transport layer protocols. Ciphers implement security by providing the encryption mechanism.

TLS is the new protocol. SSL protocol got up to version 3.0. In effect, TLS 1.0 is SSL 3.1. Currently, TLS versions include TLS 1.1 and 1.2. Each new version adds new features and modifies internal details.

Whether the RRT agent supports TLS1.1/1.2 depends on whether the underlying JRE supports TLS 1.1/1.2. The JRE that supports the RRT agent and the JRE that supports RPT workbench must both support the same version of TLS and the same ciphers.

For example, RRT 7.3 FP01 supports RPT 8.3.0.3, but RPT 8.3.0.3 does not support TLS1.1/1.2. Consequently, RRT 7.3 FP01 also does not support TLS 1.1/1.2.

In comparison, RRT 7.4 with IF21 or IF24 (7.4.0.0-TIV-CAMRT-IF0021 or 7.4.0.0-TIV-CAMRT-IF0024) can support RPT 8.3 and RPT 8.6 since RPT 8.6 supports TLS1.1 /1.2, and the IBM Java 7 included with RRT 7.4 also supports TLS 1.1/1.2.

However, when a script uses TLS 1.2/1,2, some ciphers may not be supported. To verify whether certain cipher suites are supported, visit the IBM Java Knowledge Center:

IBM Java Cipher Suite Information
http://www-01.ibm.com/support/knowledgecenter/SSYKE2_7.0.0/com.ibm.java.security.component.70.doc/security-component/jsse2Docs/ciphersuites.html?lang=en [http://www-01.ibm.com/support/knowledgecenter/SSYKE2_7.0.0/com.ibm.java.security.component.70.doc/security-component/jsse2Docs/ciphersuites.html?lang=en]

Do You Need to Patch Java?

First, determine whether your script uses 256-bit ciphers. In RPT workbench, open the script in Test Editor mode. In the left panel, drill down through the Server Access Configurations. Select SSL.

[/support/docview.wss?uid=swg21960133&aid=1]

In the right panel, examine the available ciphers that display. If the list contains 256-bit ciphers, you need to support Strong Encryption in RPT and the RRT agent. The name identifies the encryption level. For example, SSL_DHE_RSA_WITH_AES_256_CBC_SHA is a 256-bit cipher. The presence of 256 in the cipher name means that the cipher supports 256-bit encryption.

[/support/docview.wss?uid=swg21960133&aid=2] [/support/docview.wss?uid=swg21960133&aid=2]

Cipher Naming Conventions

In RPT workbench, the cipher name always begins with "SSL" to simplify naming conventions. If the script uses TLS as the protocol in the test, then the cipher is a TLS cipher.

[/support/docview.wss?uid=swg21960133&aid=3] [/support/docview.wss?uid=swg21960133&aid=3]

Playback Symptoms

Check whether your script playbacks indicate that the RRT JRE needs to be patched to support Strong Encryption. Strong Encryption adds 256-bit ciphers.

1) The Playback Status workspace shows that playbacks are complete, but the Verification Failures workspace shows:

Event Type: Generic Failure

Violated Value: java.lang.RuntimeException occurred in IBM Registration. Message: java.io.FileNotFoundException: /tmp/RPTTEMP.A1E4CC464D3DD067D

Additional Details: none

2) The trace-robotic log includes messages like the following:

[2015-05-05T22:10:58.487-04:00] - MIN - <playback-hostname> - PlaybackThreadPoolWorker-1169 - com.ibm.tivoli.transperf.playback.rpt.RPTPlaybackService.processStatusEvent() - Sending RT VP event: i=|0|, statusEvent=|SimTestStatusEvent Values: monitorName=|<script-name>|,URL=|<monitored-url>|,eventType=|com.ibm.rational.test.lt.HTTPPageVerdict|,eventId=|516.b32|,parentEventId=|516.b27|,ownerId=|A1E4ED99F22F68E2FD5CB86461633031|,text=|Error occurred during connection to server '<server-url>'. Explanation message: 'Cannot support SSL_DHE_RSA_WITH_AES_256_CBC_SHA with currently installed providers'. Since this request is the primary request for the current page all secondary requests will be skipped and the next page will be attempted.|,name=|Primary Request verdict|,actualValue=||,expectedValue=|null|,eventVerdict=|3|,eventReason=|2|,eventDesc=|null||

Patching JREs to Support TLS 1.1/1,2

By default, RPT workbench is configured with restricted or limited strength ciphers. To use less restricted encryption algorithms, you need to download and apply the unlimited jurisdiction policy files (local_policy.jar and US_export_policy.jar).

See Enabling Strong encryption greater than 128 bit key lengths in Rational Performance Tester
http://www.ibm.com/support/docview.wss?uid=swg21245273 [http://www-01.ibm.com/support/docview.wss?uid=swg21245273]

Use the following instructions to patch the JRE that the RRT agent uses.

Note: Backup the jar files that these steps replace -- before you replace these files.

1) Go to the IBM developerWorks Java Technology Security page for JRE 6 security information.
See https://www.ibm.com/developerworks/java/jdk/security/ [https://www.ibm.com/developerworks/java/jdk/security/]

2) Click on the "Java SE 6" link.

3) Click on the "IBM SDK Policy files".

4) On the Sign in page, enter your developerWorks IBM ID and password.

5) After successfully logging in, select Files for Java 5.0 SR16, Java 6 SR13, Java 6 SR5 (J9 VM2.6), Java 7 SR4, and all later releases. Click on Continue.

6) Scroll down to the License portion of the resulting page and click on the View license link to see the licensing terms for the download.

7) If the licensing terms are acceptable, check I agree and click on the I confirm link. If the terms are not acceptable, you are not able to enable strong encryption, and you should click I cancel.

8) Click on the Download now link to download the unrestricted.zip file.

9) Extract the local_policy.jar and US_export_policy.jar files from the unrestricted.zip archive.

10) Log onto the RRT agent host, and stop the RRT agent.

11) Backup the local_policy.jar and US_export_policy.jar files in the <ITM_HOME>/tmaitm6/java60/jre/lib/security and <ITM_HOME>/tmaitm6/java70/jre/lib/security directories on the RRT agent host.

12) Place those two files in the <ITM_HOME>/tmaitm6/java60/jre/lib/security and <ITM_HOME>/tmaitm6/java70/jre/lib/security directories on the RRT agent host. Replace the existing files with the same names. Verify that the file permissions are the same as the files you replaced.

13) Restart the RRT agent.

14) Try to playback the RPT script again. Does the script playback successfully, without error?

RELATED INFORMATION
 Security information for JRE 6 [https://www.ibm.com/developerworks/java/jdk/security/]
Enabling Stong encryption greater than 128 bit key leng [http://www.ibm.com/support/docview.wss?uid=swg21245273 ]

HISTORICAL NUMBER
 34602.082.000

PRODUCT ALIAS/SYNONYM
 ITCAMfT
T7.4

Question:
Why is RPT script for secure application failing during RRT agent playback with URL Unavailable ?

In the ITCAM for Transactions, Robotic Response Time agent (t6) - the Rational Performance Tester (RPT) scripts playback is failing for specific secure applications (ones that use https). The scripts which invoke the http URLs work fine.

The TEP workspace Robotic Response Time -> Playback Status->Robotic Script Verification Point Failures shows following Event Types for the RPT Script when it fails:

         Script Type                                    Event Type

         Rational Performance Tester    HTTP Return Code
         Rational Performance Tester    Content Failure
         Rational Performance Tester    URL Unavailable Failure

What could be causing the https URLs to fail, and how to resolve this?

Answer:
SSL (Secure Sockets Layer) and TLS (Transport Layer Security) are transport layer protocols. Ciphers implement security by providing the encryption mechanism.

TLS is the new protocol. SSL protocol got up to version 3.0. In effect, TLS 1.0 is SSL 3.1. Currently, TLS versions include TLS 1.1 and 1.2. Each new version adds new features and modifies internal details.

Whether the RRT agent supports TLS1.1/1.2 depends on whether the underlying JRE supports TLS 1.1/1.2. The JRE that supports the RRT agent and the JRE that supports RPT workbench must both support the same version of TLS and the same ciphers.


IBM Action required for IBM WebSphere MQ Hypervisor Edition for Red Hat Enterprise Linux Server for the Bash vulnerabilities (CVE-2014-6271, CVE-2014-7169, CVE-2014-7186, CVE-2014-7187, CVE-2014-6277 and CVE-2014-2014-6278) - United States  FLASH (ALERT)

ABSTRACT
 IBM WebSphere MQ Hypervisor Edition for Red Hat Enterprise Linux Server requires customer action for the Bash vulnerabilities that have been referred to as "Bash Bug" or "Shellshock" and the two memory corruption vulnerabilities.

CONTENT
IBM WebSphere MQ Hypervisor Edition for Red Hat Enterprise Linux Server ship with Red Hat Enterprise Linux (RHEL) that is vulnerable to CVE-2014-6271, CVE-2014-7169, CVE-2014-7186, CVE-2014-7187, CVE-2014-6277 and CVE-2014-6278 Bash vulnerabilities.

Remediation:

IBM strongly recommends that you should contact Red Hat to obtain fixes and install fixes for Red Hat Enterprise Linux (RHEL).

Change History:

September 29, 2014: Original version published.

RELATED INFORMATION
 A Japanese translation is available [http://www.ibm.com/support/docview.wss?uid=swg21685764]

Question: Do the  Bash Bug  vulnerabilities affect WebSphere MQ Hypervisor? Do the Bourne Again Shell (Bash) vulnerabilities known as Bash Bugs or Shellshock affect WebSphere MQ Hypervisor and if so, what action is required to address this situation?

Answer: IBM WebSphere MQ Hypervisor Edition for Red Hat Enterprise Linux Server ship with Red Hat Enterprise Linux (RHEL) that is vulnerable to CVE-2014-6271, CVE-2014-7169, CVE-2014-7186, CVE-2014-7187, CVE-2014-6277 and CVE-2014-6278 Bash vulnerabilities.


IBM Using dblook and ij to work with the embedded Apache Derby in WebSphere Portal - United States  TECHNOTE (TROUBLESHOOTING)

PROBLEM(ABSTRACT)
 IBM WebSphere Portal 6.1 uses an embedded version of Apache Derby out of the box. However, there is no longer a graphical tool such as CloudView (as with Cloudscape 5.x). In order to obtain the data and structure of the WebSphere Portal database, dblook and ij utilities can be used to accomplish such goals.

RESOLVING THE PROBLEM

Before proceeding with the following, it is strongly recommended that you back up your Derby database. Make a copy of <wp_profile>/PortalServer/derby/wpsdb to a backup directory. Since the version of Derby used in WebSphere Portal is embedded, you must stop the Portal server before you can access the database although you can always work on the backup copy.

NOTE: For simplicity, we will omit the extension of the utilities. You should add ".sh" or ".bat' depending on the platform.

There are three primary utility tools that are installed with WebSphere 6.1, "dblook", "ij", and "sysinfo", under the <was_root>/AppServer/derby/bin/embedded directory. The sysinfo utility generates information about the operating system, the Java version and classpath, and the Derby driver files and version information.

dblook utility
The dblook utility is used to view the database structure (in DDL - Data Definition Language) for a specific database.

The usage is dblook -d <databaseURL> [options], where databaseURL is in the "jdbc:derby:<database>" format. The <database> should be given as a full path, such as C:\IBM\WebSphere\wp_profile\derby\wpsdb.

Commonly used options include:

 *
 *
 *
 *
 *
 *
 *
 *
 *
 *
 * Examples:
 *
 *
 * dblook -d jdbc:derby:C:\IBM\WebSphere\wp_profile\PortalServer\wpsdb -o C:\temp\wpsdb_ddl.sql
 *
 *
 *
 *
 * dblook -d jdbc:derby:C:\IBM\WebSphere\wp_profile\PortalServer\wpsdb -z release -o C:\temp\wpsdb_ddl.sql
 *
 *
 *
 *
 * dblook -d jdbc:derby:C:\IBM\WebSphere\wp_profile\PortalServer\wpsdb -z release -t user_desc -verbose -o C:\temp\user_desc.sql
 *
 *

ij utility
The ij utility is a command line SQL processor. It can be used to run DDL for creating database, tables, indexes, and so on. In a WebSphere Portal environment, it would typically be used for exporting data or making simple changes (when advised by IBM Support).

To start ij, simply open a command prompt or terminal window, change the directory and enter the command. You should then see the ij shell with prompt "ij>".

The following are some common commands that you may use when reviewing data in the Portal database.  *
 * ij> connect 'jdbc:derby:C:\IBM\WebSphere\wp_profile\derby\wpsdb';
 *
 *
 *
 *
 * ij> show connections;
 *
 *
 *  CONNECTION0* - jdbc:derby:C:\ibm\websphere\wp_profile\portalserver\derby\wpsdb
   * = current connection
   ij> driver "org.apache.derby.jdbc.EmbeddedDriver';
 *
 *
 *
 * ij> set schema=release;
 *
 *
 *
 *
 * ij> select * from user_desc where oid=1000;
 *
 *
 *
 *
 * ij> run 'myquery.sql';
 *
 *
 *
 *
 *
 *
 * ij> CALL SYSCS_UTIL.SYSCS_EXPORT_TABLE('RELEASE','USER_DESC','USER_DESC.SQL',';','|',NULL);
 *
 *
 *
 *
 * ij>
 * CALL SYSCS_UTIL.SYSCS_EXPORT_QUERY('SELECT * FROM RELEASE.USER_DESC','user_desc_query.sqlL',null,'|',NULL);
 *
 *

RELATED INFORMATION
 Derby utility from Apache [http://docs.oracle.com/javadb/10.3.3.0/getstart/cgsusingtoolsutils.html]
Derby SQL references from Apache [http://db.apache.org/derby/docs/10.1/ref/crefsqlj23296.html]

Cross reference information Segment Product Component Platform Version Edition Organizational Productivity- Portals & Collaboration WebSphere Portal End of Support Products AIX, HP-UX, IBM i, Linux, Solaris, Windows, z/OS 7.0, 6.1

Question:
How can I query the Derby database in Portal via SQL statements?

I have a Portal system I just installed. I have not yet run database-transfer to copy the data from the Derby database to a DB2, Oracle, or SQL Server database. I don't wish to transfer to an external database and I have a need to run a SQL query against a table or two in the Derby database to troubleshoot an issue.

How can I perform this action?

Answer: The ij utility is a command line SQL processor. It can be used to run DDL for creating database, tables, indexes, and so on. In a WebSphere Portal environment, it would typically be used for exporting data or making simple changes


IBM Configuring DataPower MQ client to use SSL in mutual authentication mode - United States datapower; mq; websphere mq; ssl; mutual authentication mode; mq manager; 7993; 7993; 7993; machine type 7993 TECHNOTE (TROUBLESHOOTING)

PROBLEM(ABSTRACT)
 The WebSphere DataPower MQ Client can be configured to use SSL in mutual authentication mode with a Remote WebSphere MQ Manager. This step-by-step technote guides DataPower Appliance users on how to configure DataPower MQ Manager Object to use SSL in mutual authentication mode. This technote assumes that MQ queue manager is configured with key database and its associted password file for using SSL connection with other MQ clients. If it is not configured yet, it has to be done first using the URL: http://publib.boulder.ibm.com/infocenter/wmqv7/v7r0/topic/com.ibm.mq.explorer.doc/e_ssl.htm [http://publib.boulder.ibm.com/infocenter/wmqv7/v7r0/topic/com.ibm.mq.explorer.doc/e_ssl.htm]

RESOLVING THE PROBLEM
In order to use this technote, you should have a working knowledge of how to setup and administer MQ Server in Windows, AIX, Solaris, HP-UX, or Linux environment. You should also have an understanding of how to configure DataPower MQ Manager Object that connects to remote WebSphere MQ Queue Manager (qmgr). This technote focuses on configuring DataPower MQ Client to use SSL in mutual authentication mode with Firmware Releases 3.8.2 and later fixpacks. Follow these steps to configure DataPower MQ Manager Object (mq-qm object) to access WebSphere MQ Queue Manager (Remote MQ Server) in SSL mutual authentication mode.
WebSphere MQ configuration prerequisites

The following three steps are necessary to make sure that the SSL configurations for the Remote MQ Server is correctly working. Refer to IBM WebSphere MQ product manuals to configure MQ environment to work in SSL mutual authentication mode.

 1. Configure WebSphere MQ Queue Manager (Remote MQ Server) to use SSL authentication (SSLCAUTH as "required") using URL: http://publib.boulder.ibm.com/infocenter/wmqv7/v7r0/topic/com.ibm.mq.explorer.doc/e_ssl.htm [http://publib.boulder.ibm.com/infocenter/wmqv7/v7r0/topic/com.ibm.mq.explorer.doc/e_ssl.htm].
 2. Configure WebSphere MQ Client to use SSL authentication.
 3. Verify that WebSphere MQ Client can PUT/GET message(s) using application programs such as amqsputc and amqsgetc with MQ Queue Manager in SSL mutual authentication mode.

Generate self signed key/certificate
 1. Generate the self signed key/certificate pair using the "crypto tool" from the DataPower device.
 2.  Download the two files to your local machine. For the sake of illustration purpose, the names of the key and certificate files are defined as "dpmqclient-privkey.pem" and "dpmqclient-sscert.pem" respectively.
 3. Assuming that openssl tool (www.openssl.org [http://www.openssl.org]) is installed in the local machine. With openssl tool, you can use the following command to create a "pkcs12" type key from the above key/certificate pair which are of PEM type. This step is necessary as MQ key database will not import key/certificate files created as PEM.

    openssl pkcs12 -export -out dpmqclient-key.p12-in dpmqclient-sscert.pem-inkey dpmqclient-privkey.pem-name ibmwebspheremqadmin

    Note the value associated with "-name" parameter. IBM WebSphereMQ client required a friendly label as "ibmwebspheremq<userid>" of the MQ client user. In this example, the user name is being used as "admin". This user must be used in the DataPower MQ Queue Manager object and it must also be an authorized user for both the DataPower MQ instance as well as for the remote WebSphere MQ Server. Please refer to Pages G58-62 in the 3.6.0-WebGui Guide for various fields as described in MQ Queue Manager configuration screen. Also note the following two fields with appropriate values which are required for the MQ Queue Manager object to connect the remote WebSphere MQ Server in SSL mode.

 *  SSL Key Repository: The key database file name
   SSL Cipher Specification: TRIPLE_DES_SHA_US

To import a personal certificate using "iKeycmd" GUI, use the following commands in your host machine where the WebSphere MQ Server/Client is running.
 * UNIX
 *
 *
 *  gsk7cmd -cert -import -file filename -pw password -type pkcs12 -target filename -target_pw password -target_type cms
 *
 *
 * Windows
 *
 *
 *  runmqckm -cert -import -file filename -pw password -type pkcs12 -target filename -target_pw password -target_type cms
 *
 *
 *
 *
 * -file
 * filenam
 *
 *
 * -pw
 * password
 *
 *
 * -type
 * pkcs12
 *
 *
 * -target
 * filename
 *
 *
 * -target_pw
 * password
 *
 *
 * -target_type
 * cms
 *

Generate the new password file

Follow these steps to generate the new password file.
 1.  Start the iKeyman GUI using either the gsk7ikm command (on UNIX) or the strmqikm command (on Windows).
 2.  From the Key Database File menu, click Open. The Open window displays.
 3.  Click Key database type and select CMS (Certificate Management System).
 4.  Click Browse to navigate to the directory that contains the key database files.
 5.  Select the key database file in which you want to save the certificate, for example key.kdb.
 6.  Click Open. The Password Prompt window displays.
 7.  Type the password you set when you created the key database and click OK.
 8.  The name of your key database file displays in the File Name field. The Personal Certificates menu will display both "ibmwebspheremq<qmgr>" and "ibmwebspheremq<user>" labels.
 9.  In the WebSphere MQ Certificate key database, there is one certificate assigned to the queue manager or client. The certificate's Friendly Name attribute contains the string ibmwebspheremq followed in lower case by the queue manager name or the client logon ID. This Friendly Name value becomes the label of the certificate in the GSKit key database. Refer to Alter the Friendly Name (Label) of pkcs12 certificates for importing into GSKit [http://www-01.ibm.com/support/docview.wss?uid=swg21225160] if you want to alter the Friendly Name (Label) of pkcs12 certificates that are part of WebSphere MQ Certificate key database. Refer to "Migrating SSL Security Certificates in WebSphere MQ for Windows" [http://publib.boulder.ibm.com/infocenter/wmqv7/v7r0/topic/com.ibm.mq.csqzas.doc/sy12430_.htm?resultof=%22%6d%71%22%20%22%66%69%78%22%20%22%6d%69%67%72%61%74%65%64%22%20%22%6d%69%67%72%61%74%22%20%22%63%65%72%74%69%66%69%63%61%74%65%73%22%20%22%63%65%72%74%69%66%22%20] if you want to fix the migrated certificates from the WebSphere MQ V5.3 version to later version. [http://publib.boulder.ibm.com/infocenter/wmqv7/v7r0/index.jsp?topic=/com.ibm.mq.csqzao.doc/mi10240_.htm]
 10. From the key database File menu, click Stash Password. This will create the new password file as "key.sth". Select OK and close the key database File.
 11. Upload the "key.kdb" and "key.sth" files to "cert:" directory of the DataPower box. Configure the MQ client object in the DataPower box to use this key database as shown in the screen shot above to connect in SSL mutual authentication mode with the MQ Manager. The following screen shot shows the "key.kdb" and "key.sth" files are located in the "cert:" directory of the application domain.[/support/docview.wss?uid=swg21260155&aid=1] [/support/docview.wss?uid=swg21260155&aid=1] This screen shot below shows that mq-qm object is using the "key.kdb" file located in the "cert:" directory with the associated cipher specification as "TRIPLE_DES_SHA_US". Note that SSL Proxy Profile field is "(none)" as this configuration is using key repository method for SSL connection.[/support/docview.wss?uid=swg21260155&aid=2] [/support/docview.wss?uid=swg21260155&aid=2]
 12. Refresh the SSL security attribute of the MQ Manager to use this key database and password files from the host machine running MQ Server.

     Runmqsc <MQ Manager>
     Refresh security type(ssl)
     End

 13. Test your application to PUT/GET MQ message(s) using DataPower MQ client with the new configuration.

Note: DataPower 3.8 and later firmware provides a separate method for the mq-qm object to use SSL in mutual authentication mode. This method uses DataPower SSL Proxy Profile that includes Crypto profile with Identification Credential. For more details, refer to DataPower InfoCenter on how to create SSL Proxy Profile:
https://www.ibm.com/support/knowledgecenter/SS9H2Y_7.1.0/com.ibm.dp.doc/mq_securingwithansslproxyprofileobject.html [https://www.ibm.com/support/knowledgecenter/SS9H2Y_7.1.0/com.ibm.dp.doc/mq_securingwithansslproxyprofileobject.html] (Fixpack V7.1.0.x)
https://www.ibm.com/support/knowledgecenter/SS9H2Y_7.2.0/com.ibm.dp.doc/mq_securingwithansslproxyprofileobject.html [https://www.ibm.com/support/knowledgecenter/SS9H2Y_7.2.0/com.ibm.dp.doc/mq_securingwithansslproxyprofileobject.html] (Fixpack V7.2.0.x)
https://www.ibm.com/support/knowledgecenter/SS9H2Y_7.5.0/com.ibm.dp.doc/mq_securingwithansslproxyprofileobject.html [https://www.ibm.com/support/knowledgecenter/SS9H2Y_7.5.0/com.ibm.dp.doc/mq_securingwithansslproxyprofileobject.html] (Fixpack V7.5.0.x)

Note: The generation of key database can be done using IBM Key Management Tool which comes with MQ Product.

Cross reference information Segment Product Component Platform Version Edition Business Integration WebSphere DataPower Integration Appliance XI50 Not Applicable Firmware 3.8.2, 3.8.1, 3.8, 3.7.3 Edition Independent

Question: How can I configure a DataPower MQ client to use mutual authentication with SSL? I am looking to setup a DataPower MQ Client to use SSL in mutual authentication mode with a Remote WebSphere MQ Manager.

Answer:
The following three steps are necessary to make sure that the SSL configurations for the Remote MQ Server is correctly working. Refer to IBM WebSphere MQ product manuals to configure MQ environment to work in SSL mutual authentication mode.

 1. Configure WebSphere MQ Queue Manager (Remote MQ Server) to use SSL authentication (SSLCAUTH as "required") using URL: http://publib.boulder.ibm.com/infocenter/wmqv7/v7r0/topic/com.ibm.mq.explorer.doc/e_ssl.htm [http://publib.boulder.ibm.com/infocenter/wmqv7/v7r0/topic/com.ibm.mq.explorer.doc/e_ssl.htm].
 2. Configure WebSphere MQ Client to use SSL authentication.
 3. Verify that WebSphere MQ Client can PUT/GET message(s) using application programs such as amqsputc and amqsgetc with MQ Queue Manager in SSL mutual authentication mode.


IBM ITCAM Agents for WebSphere Messaging Version 7.3.0 Fix Pack 02 (7.3.0-TIV-XEforMsg-FP0002) - United States  DOWNLOADABLE FILES

ABSTRACT
 This is the second fix pack after ITCAM Agents for WebSphere Messaging Version 7.3.0 GA

DOWNLOAD DESCRIPTION
 This fix pack fixes the APARs of previous product versions.

 This fix pack provides support for IBM MQ V9 and several other enhancements(See readme).

PREREQUISITES
The following software installed in your environment is compatible with this fix pack.
Supported WebSphere MQ
* WebSphere MQ 7.1
* WebSphere MQ 7.5
* IBM MQ 8.0
* IBM MQ 9.0

Supported IBM broker products:
* WebSphere Message Broker 8.0
* IBM Integration Bus 9.0
* IBM Integration Bus 10.0

Supported IBM Tivoli Monitoring
* IBM Tivoli Monitoring 6.3.0 fix pack 2 or later

INSTALLATION INSTRUCTIONS
Refer to the Readme file on Fix Central

DOWNLOAD PACKAGE

 * 1. For distributed systems, download the following installation images from Passport Advantage [http://www-306.ibm.com/software/howtobuy/passportadvantage/index.html].
   Description Part number IBM Tivoli Composite Application Manager Agents for WebSphere Messaging V7.3.0 FP02 CNFL0EN

 * 2. For z/OS systems, install the following PTFs to bring your system to an equivalent level to this fix pack: FMID Maintenance level HKCF730 UA83334 HKMC730 UA83330 HKMQ730 UA83394 HKQI730 UA83372
 * 3. For the z/OS customer who has no agents running on distributed systems, download IBM Tivoli OMEGAMON XE for Messaging V7.3.0 Application Support Files for z/OS from the following website: Platform File to download Linux or Unix LCD7-3513-08.tar [ftp://public.dhe.ibm.com/software/tivoli_support/misc/PandA/tools_agent/tools/appsupt/LCD7-3513-08.tar] Windows LCD7-3513-08.zip [ftp://public.dhe.ibm.com/software/tivoli_support/misc/PandA/tools_agent/tools/appsupt/LCD7-3513-08.zip]

Download RELEASE DATE LANGUAGE SIZE(Bytes) Download Options
What is Fix Central(FC)? [https://www.ibm.com/support/fixcentral/help?page=swfaqs] 7.3.0-TIV-XEforMsg-FP0002 9 Dec 2016 English 1 FC [http://www.ibm.com/support/fixcentral/swg/quickorder?parent=Tivoli%20Composite%20Application%20Manager&product=ibm/Tivoli/Tivoli+Composite+Application+Manager+for+Applications&release=All&platform=All&function=fixId&fixids=7.3.0-TIV-XEforMsg-FP0002&inclu] [ ]
 [/support/docview.wss?uid=swg24043057&aid=1]Problems (APARS) fixed [/support/docview.wss?uid=swg24043057&aid=2]Problems (APARS) fixed
IV88312, IV83641, IV83002, IV82721, IV82535, IV80959, IV79995, IV79961, IV77813, IV77658, IV77411, IV88948, IV79978, IV90769, OA50555, OA51407, IV84483

Question:
Why is ITCAM MQ agent shutting down often?

We have an MQ agent instance that keeps shutting down randomly.
Below is the version of agent:
mq WebSphere MQ Monitoring Agent lx8263 Version: 07.30.01.00

Answer:
Download RELEASE DATE LANGUAGE SIZE(Bytes) Download Options
What is Fix Central(FC)? [https://www.ibm.com/support/fixcentral/help?page=swfaqs] 7.3.0-TIV-XEforMsg-FP0002 9 Dec 2016 English 1 FC


IBM How do I change the default 'fit content by' behaviour of Daeja viewer in IBM Content Navigator, to fit content by height or width? - United States fit by height; fit by width; fit; default fit; Daeja viewer; FileNet viewer; Daeja; scale TECHNOTE (FAQ)

QUESTION
 How do I change the default 'fit content by' behaviour of Daeja viewer in IBM Content Navigator, to fit content by height or width?

ANSWER
In Content Navigator v2.0.2

In the ..navigator.war/applets/filenetViewer_properties.jsp file, set the value of the parameter 'scale' as follows

To fit content by width, specify - scale: "ftow",
To fit content by height, specify - scale: "ftoh",

Here's another way to modify the behaviour:

 * make the same changes above to the filenetViewer_properties.jsp under ECMClient\configure\explodedformat\navigator\applets folder.
 * Rebuild and redeploy the ear file.
 * Restart the application server

Save the changes and they should get picked up when the viewer is re-launched.

In Content Navigator v2.0.3

The same parameter-value pair mentioned above can be added in the Additional Settings section of the Daeja ViewONE panel, of the admin desktop. Add the parameter-value pair to the Additional Settings section of

 * the Professional tab for modifying the behaviour of the Daeja Professional viewer
 * the Virtual tab for modifying the behaviour of the Daeja Virtual viewer.

Click New in the Additional Settings section to add the parameter-value pair. Save the changes and they should get picked up when the viewer is re-launched.

Question: How do I change the default 'fit content by' behaviour of Daeja viewer in IBM Content Navigator, to fit content by height or width? How do I change the default 'fit content by' behaviour of Daeja viewer in IBM Content Navigator v2.0.2, to fit content by height or width?

Answer:
In the ..navigator.war/applets/filenetViewer_properties.jsp file, set the value of the parameter 'scale' as follows

To fit content by width, specify - scale: "ftow",
To fit content by height, specify - scale: "ftoh",

Here's another way to modify the behaviour:

 * make the same changes above to the filenetViewer_properties.jsp under ECMClient\configure\explodedformat\navigator\applets folder.
 * Rebuild and redeploy the ear file.
 * Restart the application server

Save the changes and they should get picked up when the viewer is re-launched.


IBM Business Process Manager Standard detailed system requirements - United States DSREntry; SystemRequirementsDocument; prereq; coreq; installation prerequisites; DSRdoc DETAILED SYSTEM REQUIREMENTS

ABSTRACT
 This document provides access to the detailed system requirements information on the supported releases of IBM Business Process Manager Standard.

CONTENT
The detailed system requirements information is available through the Software Product Compatibility Reports [https://www.ibm.com/software/reports/compatibility/clarity/softwareReqsForProduct.html] web site. This web site provides you with the ability to dynamically generate operating system, prerequisite, server virtualization environment, translation, end of service, and detailed system requirements reports for your specific product, release, and operating system.

The following table provides direct links to the detailed system requirements information for the specified release and operating system for the IBM Business Process Manager Standard product.

TAB NAVIGATION
 * Version 8.5.7- selected tab,
 * Version 8.5.6
 * Version 8.5.5
 * Version 8.5
 * Version 8.0.1
 * Version 8.0
 * Version 7.5.1
 * Version 7.5

IBM Business Process Manager Standard Version 8.5.7 is supported on the following operating systems:

 * AIX [http://pic.dhe.ibm.com/infocenter/prodguid/v1r0/clarity-reports/report/html/softwareReqsForProduct?deliverableId=1399304491114&osPlatform=AIX]
 * Linux [http://pic.dhe.ibm.com/infocenter/prodguid/v1r0/clarity-reports/report/html/softwareReqsForProduct?deliverableId=1399304491114&osPlatform=Linux]
 * Solaris [http://pic.dhe.ibm.com/infocenter/prodguid/v1r0/clarity-reports/report/html/softwareReqsForProduct?deliverableId=1399304491114&osPlatform=Solaris]
 * Windows [http://pic.dhe.ibm.com/infocenter/prodguid/v1r0/clarity-reports/report/html/softwareReqsForProduct?deliverableId=1399304491114&osPlatform=Windows]

Notes:

 * Server virtualization environment information is available in this report [http://pic.dhe.ibm.com/infocenter/prodguid/v1r0/clarity-reports/report/html/vesForProduct?deliverableId=1399304491114]

IBM Business Process Manager Standard Version 8.5.6 is supported on the following operating systems:

 * AIX [http://pic.dhe.ibm.com/infocenter/prodguid/v1r0/clarity-reports/report/html/softwareReqsForProduct?deliverableId=1379596967826&osPlatform=AIX]
 * Linux [http://pic.dhe.ibm.com/infocenter/prodguid/v1r0/clarity-reports/report/html/softwareReqsForProduct?deliverableId=1379596967826&osPlatform=Linux]
 * Solaris [http://pic.dhe.ibm.com/infocenter/prodguid/v1r0/clarity-reports/report/html/softwareReqsForProduct?deliverableId=1379596967826&osPlatform=Solaris]
 * Windows [http://pic.dhe.ibm.com/infocenter/prodguid/v1r0/clarity-reports/report/html/softwareReqsForProduct?deliverableId=1379596967826&osPlatform=Windows]

Notes:

 * Server virtualization environment information is available in this report [http://pic.dhe.ibm.com/infocenter/prodguid/v1r0/clarity-reports/report/html/vesForProduct?deliverableId=1379596967826]

IBM Business Process Manager Standard Version 8.5.5 is supported on the following operating systems:

 * AIX [http://pic.dhe.ibm.com/infocenter/prodguid/v1r0/clarity-reports/report/html/softwareReqsForProduct?deliverableId=1362573579419&osPlatform=AIX]
 * Linux [http://pic.dhe.ibm.com/infocenter/prodguid/v1r0/clarity-reports/report/html/softwareReqsForProduct?deliverableId=1362573579419&osPlatform=Linux]
 * Solaris [http://pic.dhe.ibm.com/infocenter/prodguid/v1r0/clarity-reports/report/html/softwareReqsForProduct?deliverableId=1362573579419&osPlatform=Solaris]
 * Windows [http://pic.dhe.ibm.com/infocenter/prodguid/v1r0/clarity-reports/report/html/softwareReqsForProduct?deliverableId=1362573579419&osPlatform=Windows]

Notes:

 * Server virtualization environment information is available in this report [http://pic.dhe.ibm.com/infocenter/prodguid/v1r0/clarity-reports/report/html/vesForProduct?deliverableId=1362573579419]

IBM Business Process Manager Standard Version 8.5 is supported on the following operating systems:

 * AIX [http://pic.dhe.ibm.com/infocenter/prodguid/v1r0/clarity-reports/report/html/softwareReqsForProduct?deliverableId=1333099842423&osPlatform=AIX]
 * Linux [http://pic.dhe.ibm.com/infocenter/prodguid/v1r0/clarity-reports/report/html/softwareReqsForProduct?deliverableId=1333099842423&osPlatform=Linux]
 * Solaris [http://pic.dhe.ibm.com/infocenter/prodguid/v1r0/clarity-reports/report/html/softwareReqsForProduct?deliverableId=1333099842423&osPlatform=Solaris]
 * Windows [http://pic.dhe.ibm.com/infocenter/prodguid/v1r0/clarity-reports/report/html/softwareReqsForProduct?deliverableId=1333099842423&osPlatform=Windows]

Notes:

 * The Microsoft Internet Explorer Version 8.0 browser is deprecated in this release. You can use this browser with the IBM Business Process Manager products. However, the use of the Tab and Table Coach views, the new dashboards, and the associated Dashboard Toolkit, are not supported. For these functions, it is advised that you use one of the other supported browser versions including Microsoft Internet Explorer Versions 9 and 10.
 * Server virtualization environment information is available in this report [http://pic.dhe.ibm.com/infocenter/prodguid/v1r0/clarity-reports/report/html/vesForProduct?deliverableId=1333099842423]

IBM Business Process Manager Standard Version 8.0.1 is supported on the following operating systems:

 * AIX [http://pic.dhe.ibm.com/infocenter/prodguid/v1r0/clarity-reports/report/html/softwareReqsForProduct?deliverableId=1313410528495&osPlatform=AIX]
 * Linux [http://pic.dhe.ibm.com/infocenter/prodguid/v1r0/clarity-reports/report/html/softwareReqsForProduct?deliverableId=1313410528495&osPlatform=Linux]
 * Solaris [http://pic.dhe.ibm.com/infocenter/prodguid/v1r0/clarity-reports/report/html/softwareReqsForProduct?deliverableId=1313410528495&osPlatform=Solaris]
 * Windows [http://pic.dhe.ibm.com/infocenter/prodguid/v1r0/clarity-reports/report/html/softwareReqsForProduct?deliverableId=1313410528495&osPlatform=Windows]

Note: Server virtualization environment information is available in this report [http://pic.dhe.ibm.com/infocenter/prodguid/v1r0/clarity-reports/report/html/vesForProduct?deliverableId=1313410528495].

IBM Business Process Manager Standard Version 8.0 is supported on the following operating systems:

 * AIX [http://pic.dhe.ibm.com/infocenter/prodguid/v1r0/clarity-reports/report/html/softwareReqsForProduct?deliverableId=1301659482241&osPlatform=AIX]
 * Linux [http://pic.dhe.ibm.com/infocenter/prodguid/v1r0/clarity-reports/report/html/softwareReqsForProduct?deliverableId=1301659482241&osPlatform=Linux]
 * Solaris [http://pic.dhe.ibm.com/infocenter/prodguid/v1r0/clarity-reports/report/html/softwareReqsForProduct?deliverableId=1301659482241&osPlatform=Solaris]
 * Windows [http://pic.dhe.ibm.com/infocenter/prodguid/v1r0/clarity-reports/report/html/softwareReqsForProduct?deliverableId=1301659482241&osPlatform=Windows]

Note: Server virtualization environment information is available in this report [http://pic.dhe.ibm.com/infocenter/prodguid/v1r0/clarity-reports/report/html/vesForProduct?deliverableId=1301659482241].

IBM Business Process Manager Standard Version 7.5.1 is supported on the following operating systems:

 * AIX [http://pic.dhe.ibm.com/infocenter/prodguid/v1r0/clarity-reports/report/html/softwareReqsForProduct?deliverableId=1282724539433&osPlatform=AIX]
 * Linux [http://pic.dhe.ibm.com/infocenter/prodguid/v1r0/clarity-reports/report/html/softwareReqsForProduct?deliverableId=1282724539433&osPlatform=Linux]
 * Solaris [http://pic.dhe.ibm.com/infocenter/prodguid/v1r0/clarity-reports/report/html/softwareReqsForProduct?deliverableId=1282724539433&osPlatform=Solaris]
 * Windows [http://pic.dhe.ibm.com/infocenter/prodguid/v1r0/clarity-reports/report/html/softwareReqsForProduct?deliverableId=1282724539433&osPlatform=Windows]

Note: Server virtualization environment information is available in this report [http://pic.dhe.ibm.com/infocenter/prodguid/v1r0/clarity-reports/report/html/vesForProduct?deliverableId=1282724539433].

IBM Business Process Manager Standard Version 7.5 is supported on the following operating systems:

 * AIX [http://pic.dhe.ibm.com/infocenter/prodguid/v1r0/clarity-reports/report/html/softwareReqsForProduct?deliverableId=1284157761205&osPlatform=AIX]
 * Linux [http://pic.dhe.ibm.com/infocenter/prodguid/v1r0/clarity-reports/report/html/softwareReqsForProduct?deliverableId=1284157761205&osPlatform=Linux]
 * Solaris [http://pic.dhe.ibm.com/infocenter/prodguid/v1r0/clarity-reports/report/html/softwareReqsForProduct?deliverableId=1284157761205&osPlatform=Solaris]
 * Windows [http://pic.dhe.ibm.com/infocenter/prodguid/v1r0/clarity-reports/report/html/softwareReqsForProduct?deliverableId=1284157761205&osPlatform=Windows]

Note: Server virtualization environment information is available in this report [http://pic.dhe.ibm.com/infocenter/prodguid/v1r0/clarity-reports/report/html/vesForProduct?deliverableId=1284157761205&].

Note: Your entitlement to support, if any, is dependent upon your license and/or maintenance agreements for IBM Business Process Manager Standard and is limited to your use of the relevant prerequisite with a supported IBM Business Process Manager Standard product.

RELATED INFORMATION
 IBM Business Process Manager Tools & Add-Ons [http://www.ibm.com/support/docview.wss?uid=swg27023009]
IBM Integration Designer detailed system requirements [http://www.ibm.com/support/docview.wss?uid=swg27022441]

ORIGINAL PUBLICATION DATE
 2011/10/4

PRODUCT ALIAS/SYNONYM
 BPM

Question:
Is Internet Explorer 11 supported by Lombardi 7.2.XX  We are using Lombardi 7.2.0.5 version. We are planning to upgrade Internet Explorer to IE 11 version.

Is IE 11 supported? Are there any known issues?

Answer:
The following table provides direct links to the detailed system requirements information for the specified release and operating system for the IBM Business Process Manager Standard product.

TAB NAVIGATION
 * Version 8.5.7- selected tab,
 * Version 8.5.6
 * Version 8.5.5
 * Version 8.5
 * Version 8.0.1
 * Version 8.0
 * Version 7.5.1
 * Version 7.5


IBM Application Error in IBM Content Collector Configuration Manager when saving a task route - United States icc; fips; md5 TECHNOTE (TROUBLESHOOTING)

PROBLEM(ABSTRACT)
 An application error is reported in the IBM Content Collector (ICC) configuration manager when you try to save a task route or other settings.

SYMPTOM
The pop up window shows the following message:

 *
 * Error:
 *
   A severe error occurred.

 * Problem:
 *
   Exception has been thrown by the target of an invocation.

 * Solution:
 *
   Contact IBM Software Support with this error message (see Details).

Click on the Details button and the following stack trace is reported:

 * Details
 * System.Reflection.TargetInvocationException: Exception has been thrown by the target of an invocation.
   at System.RuntimeMethodHandle.InvokeMethod(Object target, Object[] arguments, Signature sig, Boolean constructor)
   at System.Reflection.RuntimeConstructorInfo.Invoke(BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture)
   .....
   .....
   System.InvalidOperationException: This implementation is not part of the Windows Platform FIPS validated cryptographic algorithms.
   at System.Security.Cryptography.MD5CryptoServiceProvider..ctor()

CAUSE
Incompatible Windows security policy.

DIAGNOSING THE PROBLEM
Scroll down to the bottom of the detail section and verify that the following error is seen:

 *
 *
 *
 *
 *
 * System.InvalidOperationException: This implementation is not part of the Windows Platform FIPS validated cryptographic algorithms.
   at System.Security.Cryptography.MD5CryptoServiceProvider..ctor()

RESOLVING THE PROBLEM
To resolve the problem, go to the following:

 * Navigate to Control Panel > Administrative Tools > Local Security Policy > Security Settings > Local Policy > Security Options.
 * In security option, select and double click on System Cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing
 * Check if the option is enabled. If it is enabled, disable this option and try to save the changes in ICC configuration manager again.

If problem persists after disabling the option, contact IBM support for further assistance.

Question:
ICC configuration manager error: This implementation is not part of the Windows Platform FIPS validated cryptographic algorithms. When saving changes in ICC configuration manager, an "Application Error" window pops up.

Error:

A severe error occurred.

Problem:

Exception has been thrown by the target of an invocation.

Solution:

Contact IBM Software Support with this error message (see Details).

Click on the Details button and the following stack trace is reported:

Details

System.Reflection.TargetInvocationException: Exception has been thrown by the target of an invocation. at System.RuntimeMethodHandle.InvokeMethod(Object target, Object[] arguments, Signature sig, Boolean constructor) at System.Reflection.RuntimeConstructorInfo.Invoke(BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture)

.....

.....

System.InvalidOperationException: This implementation is not part of the Windows Platform FIPS validated cryptographic algorithms.

at System.Security.Cryptography.MD5CryptoServiceProvider..ctor()

What is causing this?

Answer: Incompatible Windows security policy.